Malicious PyPI Versions of PyTorch Lightning Target Developers in Supply Chain Attack Threat actors compromised the popular Python package PyTorch Lightning, publishing two malicious versions 2.6.2 and 2.6.3 on April 30, 2026, as part of a broader software supply chain attack. The campaign, linked to the Mini Shai-Hulud incident that previously targeted SAP-related npm packages, was uncovered by security firms Aikido Security, OX Security, Socket, and StepSecurity. The compromised versions contained a hidden `_runtime` directory with an obfuscated JavaScript payload that executed automatically upon package import. The attack chain downloaded the Bun JavaScript runtime and deployed an 11MB obfuscated script (router_runtime.js) designed for credential theft. Validated GitHub tokens were used to inject worm-like payloads into up to 50 branches per repository, silently overwriting files with commits impersonating Anthropic’s Claude Code. Additionally, the malware modified local npm packages by adding a postinstall hook to package.json, incrementing version numbers, and repackaging tarballs. If published, these tampered packages would propagate the malware to downstream systems. The Python Package Index (PyPI) has since quarantined the affected versions. While the exact cause of the compromise remains under investigation, evidence suggests the PyTorch Lightning GitHub account was breached. Maintainers confirmed the malicious versions introduced credential-harvesting functionality and advised users to downgrade to version 2.6.1 and rotate exposed credentials. The attack has been attributed to TeamPCP, a threat group previously suspended from X for policy violations. The group has since launched a dark web onion site and claimed ties to LAPSUS$, while denying use of the VECT encryption tool instead asserting ownership of CipherForce, its proprietary ransomware locker. In a related incident, version 7.0.4 of the *intercom-client* npm package was also compromised under the Mini Shai-Hulud campaign, employing a preinstall hook to execute credential-stealing malware. Security researchers noted technical overlaps with prior TeamPCP attacks targeting Checkmarx, Bitwarden, Telnyx, LiteLLM, and Aqua Security Trivy.